@contember/engine-tenant-api 2.1.0-alpha.3 → 2.1.0-alpha.30

package/graphql.codegen.yml

@@ -1,11 +1,15 @@
 schema:
   - "./src/schema/tenant.graphql.ts"
 documents: []
-config:
-  immutableTypes: "1"
 generates:
   ./src/schema/index.ts:
     config:
+      scalars:
+        DateTime: Date
+        Json: unknown
+        Interval:
+          input: './types#Interval'
+          output: './types#OutputInterval'
       immutableTypes: true
       enumsAsTypes: true
     plugins:
@@ -14,4 +18,4 @@ generates:
       - "typescript-resolvers"
 hooks:
   afterAllFileWrite:
-    - yarn run -T eslint --fix
+    - bun run eslint --fix

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.1.0-alpha.3",
+  "version": "2.1.0-alpha.30",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,26 +26,27 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.1.0-alpha.3",
-    "@contember/config-loader": "2.1.0-alpha.3",
-    "@contember/database": "2.1.0-alpha.3",
-    "@contember/database-migrations": "2.1.0-alpha.3",
-    "@contember/dic": "2.1.0-alpha.3",
-    "@contember/graphql-utils": "2.1.0-alpha.3",
-    "@contember/logger": "2.1.0-alpha.3",
-    "@contember/schema": "2.1.0-alpha.3",
-    "@contember/schema-utils": "2.1.0-alpha.3",
-    "@contember/typesafe": "2.1.0-alpha.3",
+    "@contember/authorization": "2.1.0-alpha.30",
+    "@contember/config-loader": "2.1.0-alpha.30",
+    "@contember/database": "2.1.0-alpha.30",
+    "@contember/database-migrations": "2.1.0-alpha.30",
+    "@contember/dic": "2.1.0-alpha.30",
+    "@contember/graphql-utils": "2.1.0-alpha.30",
+    "@contember/logger": "2.1.0-alpha.30",
+    "@contember/schema": "2.1.0-alpha.30",
+    "@contember/schema-utils": "2.1.0-alpha.30",
+    "@contember/typesafe": "2.1.0-alpha.30",
     "@graphql-tools/utils": "^10.5.5",
     "graphql-tag": "^2.12.6",
     "jose": "^5.8.0",
     "mustache": "^4.2.0",
     "nodemailer": "^6.9.15",
+    "postgres-interval": "^2.1.0",
     "openid-client": "^5.7.0",
     "otpauth": "^9.3.4"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.1.0-alpha.3",
+    "@contember/database-tester": "2.1.0-alpha.30",
     "@graphql-tools/schema": "^10.0.7",
     "@types/mustache": "^4.2.5",
     "@types/node": "^20.17.22",

package/src/TenantContainer.ts

@@ -85,6 +85,8 @@ import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQuery
 import { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver'
 import { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager'
 import { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver'
+import { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator'
+import { AuthLogService } from './model/service/AuthLogService'
 
 export interface TenantContainer {
 	projectMemberManager: ProjectMemberManager
@@ -160,10 +162,12 @@ export class TenantContainerFactory {
 				new ApiKeyManager(apiKeyService))
 			.addService('emailValidator', () =>
 				new EmailValidator())
-			.addService('signUpManager', ({ emailValidator }) =>
-				new SignUpManager(emailValidator))
-			.addService('passwordChangeManager', ({ providers }) =>
-				new PasswordChangeManager(providers))
+			.addService('passwordStrengthValidator', () =>
+				new PasswordStrengthValidator())
+			.addService('signUpManager', ({ emailValidator, passwordStrengthValidator }) =>
+				new SignUpManager(emailValidator, passwordStrengthValidator))
+			.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) =>
+				new PasswordChangeManager(providers, passwordStrengthValidator))
 			.addService('projectMemberManager', () =>
 				new ProjectMemberManager())
 			.addService('identityFactory', ({ projectMemberManager }) =>
@@ -180,8 +184,8 @@ export class TenantContainerFactory {
 				new PersonAccessManager(apiKeyManager))
 			.addService('personManager', ({ emailValidator }) =>
 				new PersonManager(emailValidator))
-			.addService('passwordResetManager', ({ userMailer, projectManager }) =>
-				new PasswordResetManager(userMailer, projectManager))
+			.addService('passwordResetManager', ({ userMailer, projectManager, passwordStrengthValidator }) =>
+				new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator))
 			.addService('idpRegistry', () => {
 				const idpRegistry = new IDPHandlerRegistry()
 				idpRegistry.registerHandler('oidc', new OIDCProvider())
@@ -209,8 +213,8 @@ export class TenantContainerFactory {
 				new RolesManager())
 			.addService('configurationManager', () =>
 				new ConfigurationManager())
-			.addService('passwordlessSignInManager', ({ apiKeyManager, configurationManager, userMailer, projectManager, otpAuthenticator }) =>
-				new PasswordlessSignInManager(apiKeyManager, configurationManager, userMailer, projectManager, otpAuthenticator))
+			.addService('passwordlessSignInManager', ({ apiKeyManager, userMailer, projectManager, otpAuthenticator }) =>
+				new PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpAuthenticator))
 
 			.addService('identityTypeResolver', ({ projectMemberManager, projectManager, permissionContextFactory }) =>
 				new IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory))
@@ -286,8 +290,10 @@ export class TenantContainerFactory {
 				new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory))
 			.addService('togglePasswordlessMutationResolver', ({ configurationManager, personManager }) =>
 				new TogglePasswordlessMutationResolver(configurationManager, personManager))
-			.addService('resolverContextFactory', ({ permissionContextFactory }) =>
-				new TenantResolverContextFactory(permissionContextFactory))
+			.addService('authLogService', () =>
+				new AuthLogService())
+			.addService('resolverContextFactory', ({ permissionContextFactory, authLogService }) =>
+				new TenantResolverContextFactory(permissionContextFactory, authLogService))
 			.addService('resolvers', container =>
 				new ResolverFactory(container).create())
 			.addService('connection', () =>

package/src/migrations/2025-04-16-180000-config-up.ts

@@ -0,0 +1,39 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+    ALTER TABLE "config"
+        ADD COLUMN "password_min_length"            INTEGER  NOT NULL DEFAULT 8,
+        ADD COLUMN "password_require_uppercase"     INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_lowercase"     INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_digit"         INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_special"       INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "password_pattern"               TEXT     DEFAULT NULL,
+        ADD COLUMN "password_check_blacklist"       BOOLEAN  NOT NULL DEFAULT TRUE,
+        ADD COLUMN "login_base_backoff"             INTERVAL NOT NULL DEFAULT '1 second',
+        ADD COLUMN "login_max_backoff"              INTERVAL NOT NULL DEFAULT '60 second',
+        ADD COLUMN "login_attempt_window"           INTERVAL NOT NULL DEFAULT '5 minute',
+        ADD COLUMN "login_reveal_user_exits"        BOOLEAN  NOT NULL DEFAULT TRUE,
+        ADD COLUMN "login_default_token_expiration" INTERVAL NOT NULL DEFAULT '30 minute',
+        ADD COLUMN "login_max_token_expiration"     INTERVAL DEFAULT '6 month';
+    ALTER TABLE "config"
+        RENAME passwordless_expiration_minutes TO passwordless_expiration;
+
+    ALTER TABLE "config"
+        ALTER COLUMN passwordless_expiration DROP DEFAULT,
+        ALTER COLUMN passwordless_expiration TYPE INTERVAL USING passwordless_expiration * INTERVAL '1 minute',
+        ALTER COLUMN passwordless_expiration SET DEFAULT INTERVAL '5 minute';
+
+-- revert defaults for existing projects
+    UPDATE "config"
+    SET password_min_length        = 6,
+        password_require_uppercase = 0,
+        password_require_lowercase = 0,
+        password_require_digit     = 0,
+        password_check_blacklist   = FALSE,
+        login_max_token_expiration = NULL;
+
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2025-04-17-160000-auth-log.ts

@@ -0,0 +1,45 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+CREATE TYPE auth_log_type AS ENUM (
+  'login',
+  'create_session_token',
+  'idp_login',
+  'password_reset_init',
+  'password_reset',
+  'password_change',
+  'email_change',
+  '2fa_disable',
+  '2fa_enable',
+  'passwordless_login_init',
+  'passwordless_login_exchange',
+  'passwordless_login',
+  'person_disable'
+);
+
+CREATE TABLE person_auth_log (
+  id UUID PRIMARY KEY,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  invoked_by_id UUID REFERENCES identity(id) ON DELETE SET NULL,
+  person_id UUID REFERENCES person(id) ON DELETE SET NULL,
+  person_token_id UUID REFERENCES person_token(id) ON DELETE SET NULL,
+  person_input_identifier TEXT DEFAULT NULL,
+  type auth_log_type NOT NULL,
+  success BOOLEAN NOT NULL,
+  error_code TEXT,
+  error_message TEXT,
+  ip_address INET,
+  user_agent TEXT,
+  identity_provider_id UUID REFERENCES identity_provider(id) ON DELETE SET NULL,
+  metadata JSONB
+);
+CREATE INDEX ON person_auth_log (person_input_identifier, created_at DESC)
+	WHERE type = 'login' AND success = FALSE;
+
+CREATE INDEX ON person_auth_log (person_id, created_at DESC);
+                                                     
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -38,7 +38,8 @@ import _20230603104000persondisabled from './2023-06-03-104000-person-disabled'
 import _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config'
 import _20240620140000mailreply from './2024-06-20-140000-mail-reply'
 import _20240826120000passwordless from './2024-08-26-120000-passwordless'
-
+import _20250416180000configup from './2025-04-16-180000-config-up'
+import _20250417160000authlog from './2025-04-17-160000-auth-log'
 import snapshot from './snapshot'
 import { computeTokenHash, Providers } from '../model'
 import { Logger } from '@contember/logger'
@@ -89,6 +90,8 @@ const migrations = {
 	'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,
 	'2024-06-20-140000-mail-reply': _20240620140000mailreply,
 	'2024-08-26-120000-passwordless': _20240826120000passwordless,
+	'2025-04-16-180000-config-up': _20250416180000configup,
+	'2025-04-17-160000-auth-log': _20250417160000authlog,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -4,6 +4,21 @@ import { createCredentials } from './tenantCredentials'
 
 export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
 	builder.sql(`
+CREATE TYPE "auth_log_type" AS ENUM (
+    'login',
+    'create_session_token',
+    'idp_login',
+    'password_reset_init',
+    'password_reset',
+    'password_change',
+    'email_change',
+    '2fa_disable',
+    '2fa_enable',
+    'passwordless_login_init',
+    'passwordless_login_exchange',
+    'passwordless_login',
+    'person_disable'
+);
 CREATE TYPE "config_policy" AS ENUM (
     'always',
     'never',
@@ -57,7 +72,20 @@ CREATE TABLE "config" (
     "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
     "passwordless_enabled" "config_policy" DEFAULT 'never'::"config_policy" NOT NULL,
     "passwordless_url" "text",
-    "passwordless_expiration_minutes" integer DEFAULT 5 NOT NULL
+    "passwordless_expiration" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "password_min_length" integer DEFAULT 8 NOT NULL,
+    "password_require_uppercase" integer DEFAULT 1 NOT NULL,
+    "password_require_lowercase" integer DEFAULT 1 NOT NULL,
+    "password_require_digit" integer DEFAULT 1 NOT NULL,
+    "password_require_special" integer DEFAULT 0 NOT NULL,
+    "password_pattern" "text",
+    "password_check_blacklist" boolean DEFAULT true NOT NULL,
+    "login_base_backoff" interval DEFAULT '00:00:01'::interval NOT NULL,
+    "login_max_backoff" interval DEFAULT '00:01:00'::interval NOT NULL,
+    "login_attempt_window" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "login_reveal_user_exits" boolean DEFAULT true NOT NULL,
+    "login_default_token_expiration" interval DEFAULT '00:30:00'::interval NOT NULL,
+    "login_max_token_expiration" interval DEFAULT '6 mons'::interval
 );
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
@@ -99,6 +127,22 @@ CREATE TABLE "person" (
     "passwordless_enabled" boolean,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
+CREATE TABLE "person_auth_log" (
+    "id" "uuid" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "invoked_by_id" "uuid",
+    "person_id" "uuid",
+    "person_token_id" "uuid",
+    "person_input_identifier" "text",
+    "type" "auth_log_type" NOT NULL,
+    "success" boolean NOT NULL,
+    "error_code" "text",
+    "error_message" "text",
+    "ip_address" "inet",
+    "user_agent" "text",
+    "identity_provider_id" "uuid",
+    "metadata" "jsonb"
+);
 CREATE TABLE "person_identity_provider" (
     "id" "uuid" NOT NULL,
     "person_id" "uuid" NOT NULL,
@@ -159,6 +203,8 @@ ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
@@ -183,6 +229,7 @@ CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
 CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
 CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
 CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
+CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC);
 CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
 CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
@@ -202,6 +249,14 @@ ALTER TABLE ONLY "identity"
     ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_identity_provider_id_fkey" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_invoked_by_id_fkey" FOREIGN KEY ("invoked_by_id") REFERENCES "identity"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_token_id_fkey" FOREIGN KEY ("person_token_id") REFERENCES "person_token"("id") ON DELETE SET NULL;
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "person_identity_provider"

package/src/model/authorization/MembershipMatcher.ts

@@ -12,6 +12,12 @@ export class MembershipMatcher {
 
 	matches(membership: Acl.Membership): boolean {
 		return this.memberships.some(invokerMembership => {
+			if (invokerMembership.matchRule === true) {
+				return true
+			}
+			if (!invokerMembership.matchRule) {
+				return false
+			}
 			const matchRule = invokerMembership.matchRule[membership.role]
 			if (!matchRule) {
 				return false

package/src/model/authorization/PermissionsFactory.ts

@@ -4,7 +4,7 @@ import { TenantRole } from './Roles'
 
 const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])
 
-const projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {
+const projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {
 	return roles === undefined || roles.every(it => allowedRoles.has(it))
 }
 
@@ -37,6 +37,8 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -0,0 +1,51 @@
+import { Command } from '../Command'
+import { AuthActionType } from '../../type/AuthLog'
+import { InsertBuilder } from '@contember/database'
+import { JSONValue } from '@contember/schema'
+
+export class CreateAuthLogEntryCommand implements Command<void> {
+	constructor(
+		private readonly data: CreateAuthLogEntryCommand.Entry,
+	) {
+	}
+
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await InsertBuilder.create()
+			.into('person_auth_log')
+			.values({
+				id: providers.uuid(),
+				invoked_by_id: this.data.invokedById,
+				person_id: this.data.personId,
+				person_input_identifier: this.data.personInputIdentifier,
+				person_token_id: this.data.personTokenId,
+				type: this.data.type,
+				success: this.data.success,
+				error_code: this.data.errorCode,
+				error_message: this.data.errorMessage,
+				ip_address: this.data.ipAddress,
+				user_agent: this.data.userAgent,
+				identity_provider_id: this.data.identityProviderId,
+				metadata: this.data.metadata ?? {},
+			})
+			.execute(db)
+
+	}
+}
+
+namespace CreateAuthLogEntryCommand {
+	export type Entry = {
+		type: AuthActionType
+		invokedById: string
+		personInputIdentifier?: string
+		personId?: string
+		personTokenId?: string
+		success: boolean
+		errorCode?: string
+		errorMessage?: string
+		ipAddress?: string
+		userAgent?: string
+		identityProviderId?: string
+		metadata?: JSONValue
+	}
+}

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -1,6 +1,8 @@
 import { Command } from '../Command'
 import { ConfigInput } from '../../../schema'
 import { UpdateBuilder } from '@contember/database'
+import { ConfigRow } from '../../type/Config'
+import { IPostgresInterval } from 'postgres-interval'
 
 export class UpdateConfigurationCommand implements Command<void> {
 	constructor(
@@ -9,13 +11,29 @@ export class UpdateConfigurationCommand implements Command<void> {
 	}
 
 	async execute({ db }: Command.Args): Promise<void> {
+
 		const result = await UpdateBuilder.create()
 			.table('config')
 			.where({ id: 'singleton' })
 			.values({
-				passwordless_enabled: this.configuration.passwordless?.enabled,
+				passwordless_enabled: this.configuration.passwordless?.enabled ?? undefined,
 				passwordless_url: this.configuration.passwordless?.url,
-				passwordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes,
+				passwordless_expiration: this.configuration.passwordless?.expiration ?? undefined,
+				password_min_length: this.configuration.password?.minLength ?? undefined,
+				password_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,
+				password_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,
+				password_require_digit: this.configuration.password?.requireDigit ?? undefined,
+				password_require_special: this.configuration.password?.requireSpecial ?? undefined,
+				password_pattern: this.configuration.password?.pattern,
+				password_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,
+				login_base_backoff: this.configuration.login?.baseBackoff ?? undefined,
+				login_max_backoff: this.configuration.login?.maxBackoff ?? undefined,
+				login_attempt_window: this.configuration.login?.attemptWindow ?? undefined,
+				login_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,
+				login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,
+				login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+			} satisfies {
+				[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined
 			})
 			.execute(db)
 		if (!result) {

package/src/model/dtos/AuthLogBag.ts

@@ -0,0 +1,3 @@
+export namespace AuthLogData {
+
+}

package/src/model/mailing/UserMailer.ts

@@ -59,7 +59,7 @@ export class UserMailer {
 
 	async sendPasswordlessEmail(
 		dbContext: DatabaseContext,
-		mailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },
+		mailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },
 		customMailOptions: { projectId: string | null; variant: string },
 	): Promise<void> {
 		const templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }

package/src/model/queries/authLog/NextLoginAttemptQuery.ts

@@ -0,0 +1,63 @@
+import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
+
+export class NextLoginAttemptQuery extends DatabaseQuery<Date> {
+
+	constructor(
+		private readonly email: string,
+	) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<Date> {
+		const qb = SelectBuilder.create()
+			.with('cfg', it => it.from('config'))
+			.with('last_successful_reset', it => it
+				.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')
+				.from('person_auth_log')
+				.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))
+				.where({
+					type: 'password_reset',
+					success: true,
+					email: this.email,
+				}),
+			)
+			.with('window_start', it => it
+				.select(new Literal(`
+					GREATEST(
+						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), 
+						NOW() - cfg.login_attempt_window
+					)`), 'start_time')
+				.from('cfg')
+				.from('last_successful_reset'),
+			)
+			.with('failed_logins', it => it
+				.select(new Literal('COUNT(*)'), 'fails')
+				.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')
+				.from('person_auth_log')
+				.from('window_start')
+				.where({
+					person_input_identifier: this.email,
+					type: 'login',
+					success: false,
+				})
+				.where(new Literal('person_auth_log.created_at >= window_start.start_time')),
+			)
+			.select(new Literal(`
+				CASE WHEN failed_logins.fails = 0 
+				THEN NOW() 
+				ELSE LEAST(
+					failed_logins.last_fail + cfg.login_max_backoff, 
+					failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+				) END`), 'next_allowed_login')
+			.from('failed_logins')
+			.from('cfg')
+
+		const result = await qb.getResult(db)
+		if (result.length === 0) {
+			return new Date()
+		}
+		return result[0].next_allowed_login
+	}
+
+
+}

package/src/model/queries/configuration/ConfigurationQuery.ts

@@ -1,10 +1,10 @@
 import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
-import { Config, ConfigPolicy } from '../../../schema'
+import { Config, ConfigRow } from '../../type/Config'
 
 export class ConfigurationQuery extends DatabaseQuery<Config> {
 
 	async fetch({ db }: DatabaseQueryable): Promise<Config> {
-		const rows = await SelectBuilder.create<ConfigurationRow>()
+		const rows = await SelectBuilder.create<ConfigRow>()
 			.from('config')
 			.select(new Literal('*'))
 			.getResult(db)
@@ -17,14 +17,26 @@ export class ConfigurationQuery extends DatabaseQuery<Config> {
 			passwordless: {
 				enabled: result.passwordless_enabled,
 				url: result.passwordless_url,
-				expirationMinutes: result.passwordless_expiration_minutes,
+				expiration: result.passwordless_expiration,
+			},
+			password: {
+				minLength: result.password_min_length,
+				requireUppercase: result.password_require_uppercase,
+				requireLowercase: result.password_require_lowercase,
+				requireDigit: result.password_require_digit,
+				requireSpecial: result.password_require_special,
+				pattern: result.password_pattern,
+				checkBlacklist: result.password_check_blacklist,
+			},
+			login: {
+				baseBackoff: result.login_base_backoff,
+				maxBackoff: result.login_max_backoff,
+				attemptWindow: result.login_attempt_window,
+				revealUserExists: result.login_reveal_user_exits,
+				defaultTokenExpiration: result.login_default_token_expiration,
+				maxTokenExpiration: result.login_max_token_expiration,
 			},
 		}
 	}
 }
 
-interface ConfigurationRow {
-	passwordless_enabled: ConfigPolicy
-	passwordless_url: string | null
-	passwordless_expiration_minutes: number
-}

package/src/model/service/AuthLogService.ts

@@ -0,0 +1,62 @@
+import { DatabaseContext } from '../utils'
+import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand'
+import { Response } from '../utils/Response'
+import { AuthActionType } from '../type/AuthLog'
+
+class AuthLogService {
+	async logAuthAction(
+		db: DatabaseContext,
+		ctx: { identityId: string; clientIp?: string; userAgent?: string },
+		data: AuthLogService.LogArgs,
+	): Promise<void> {
+		const dataContainer = data.response.ok
+			? data.response.result ?? {}
+			: data.response.metadata ?? {}
+		const authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer
+			? dataContainer[AuthLogService.Key] as AuthLogService.Bag
+			: undefined
+
+		await db.commandBus.execute(new CreateAuthLogEntryCommand({
+			success: data.response.ok,
+			personInputIdentifier: data.personInput ?? authData?.data?.personInput,
+			personId: data.personId ?? authData?.data?.personId,
+			invokedById: ctx.identityId,
+			type: data.type,
+			identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
+			errorCode: data.response.ok ? null : data.response.error,
+			personTokenId: data.tokenId ?? authData?.data?.tokenId,
+			errorMessage: data.response.ok ? undefined : data.response.errorMessage,
+			ipAddress: ctx.clientIp,
+			userAgent: ctx.userAgent,
+			metadata: {},
+		}))
+	}
+}
+
+namespace AuthLogService {
+	export const Key = Symbol('AuthLogData')
+	type Data = {
+		personId?: string
+		personInput?: string // e.g. email
+		tokenId?: string
+		identityProviderId?: string
+	}
+
+	export type LogArgs = {
+		response: Response<
+			null | { [Key]?: Bag },
+			any,
+			{} | { [Key]?: Bag }
+		>
+		type: AuthActionType
+	} & Data
+
+	export class Bag {
+		constructor(
+			public readonly data: Data,
+		) {
+		}
+	}
+}
+
+export { AuthLogService }